The interpreter engine for the core JavaScript language, independent of the browser's object model. File ONLY core JavaScript language bugs in this category. For bugs involving browser objects such as "window" and "document", use the "DOM" component. For bugs involving calls between JavaScript and C++, use the "XPConnect" component.

Yes, removing (unifdef'ing for JS_HAS_SCRIPT_OBJECT == 0, or just #define'ing that jsconfig.h macro to 0) will fix this and other bugs. But that's an API change, and we try to avoid those on the stable branches.
I'll go look at that bug now.
/be

Created attachment 253102[details][diff][review]
same reordering concept
Weird, in my testing with the compile fix, this didn't crash. Can you please try this patch out, moz_bug? Same reordering concept as the other two. Asking for branch approval now so I can land all three of these together, pending r+ from brendan.

Created attachment 253125[details][diff][review]
Moved instanceof check up
I'm going to hope my branch-approval is grandfathered in, regardless of this tweak, and just land this tonight with the other two. dveditz or whoever, please re-stamp when it's convenient, or let me know if it's not for some reason and I will back out.